{"id":"CVE-2026-54851","kind":"vulnerability","aliases":["CVE-2026-54851"],"related":[],"title":"WPForms Lite: reflected XSS lets attackers run scripts in visitors' browsers","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Awesomemotive Contact Form by WPForms wpforms-lite allows Reflected XSS.This issue affects Contact Form by WPForms: from n/a through 2.0.3.","summary":"Contact Form by WPForms (wpforms-lite) does not neutralize input in generated web pages, enabling reflected cross-site scripting. An attacker can get script to run in a victim's browser through a crafted link.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wpforms-lite"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the WPForms Lite plugin in the WordPress admin under Plugins.\n- Confirm whether the site runs Contact Form by WPForms version `2.0.3` or earlier.","fix":"- Contact Form by WPForms (wpforms-lite): versions through `2.0.3` are affected; a fixed version is not stated in the sources.","status":"open","published_at":"2026-11-04T07:17:12+00:00","first_seen_at":"2026-11-04T07:25:30+00:00","triaged_at":"2026-11-04T07:26:25+00:00","updated_at":"2026-11-04T07:26:25+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-04T07:26:25Z","model":"claude-haiku-5-5","output":{"fix":"- Contact Form by WPForms (wpforms-lite): versions through `2.0.3` are affected; a fixed version is not stated in the sources.","reach":"internet","title":"WPForms Lite: reflected XSS lets attackers run scripts in visitors' browsers","impact":"medium","summary":"Contact Form by WPForms (wpforms-lite) does not neutralize input in generated web pages, enabling reflected cross-site scripting. An attacker can get script to run in a victim's browser through a crafted link.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wpforms-lite","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker script runs in a victim's browser on the affected site","analyst_note":"Find the fixed WPForms Lite version and the exact trigger path in the NVD entry or the plugin changelog.","how_to_check":"- Check the installed version of the WPForms Lite plugin in the WordPress admin under Plugins.\n- Confirm whether the site runs Contact Form by WPForms version `2.0.3` or earlier.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the WPForms Lite WordPress plugin at version 2.0.3 or earlier are exposed. The sources do not say whether specific form configurations or authentication are needed to trigger the reflected input.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000692,"input_tokens":4131,"output_tokens":558,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-54851':14A,17A '2.0.3':97C 'affect':89C 'allow':85C 'attack':6A,48B 'awesomemot':77C 'browser':11A,58B 'contact':26B,78C,90C 'craft':61B 'cross':44B,72C 'cross-sit':43B,71C 'cve':12A,15A 'enabl':41B 'form':27B,79C,91C 'generat':38B,70C 'get':50B 'host':21B 'improp':63C 'input':36B,66C 'issu':88C 'let':5A 'link':62B 'lite':2A,25B,32B,84C 'n/a':95C 'neutral':35B,64C 'packag':18B 'page':40B,69C 'reflect':3A,42B,86C 'run':7A,53B 'script':8A,46B,51B,74C 'self':20B 'self-host':19B 'site':45B,73C 'victim':56B 'visitor':10A 'vulner':75C 'web':39B,68C 'wordpress':22B 'wpform':1A,24B,29B,31B,81C,83C,93C 'wpforms-lit':23B,30B,82C 'xss':4A 'xss.this':87C","nicknames":[],"mitigations":[],"who_affected":"Sites running the WPForms Lite WordPress plugin at version 2.0.3 or earlier are exposed. The sources do not say whether specific form configurations or authentication are needed to trigger the reflected input.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","package","selfhosted","wordpress","wpformslite"],"campaign_type":null,"first_public_at":"2026-11-04T07:17:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-54851","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54851","severity":null,"published_at":"2026-11-04T07:17:12+00:00","modified_at":"2026-11-04T07:17:12+00:00","first_seen_at":"2026-11-04T07:25:30+00:00","fetched_at":"2026-11-04T07:25:30+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}